All data stored in our database (Supabase) is encrypted at rest using AES-256. All connections to Layerdock are served over HTTPS with TLS 1.3, ensuring data in transit is fully encrypted. File uploads are encrypted using server-side encryption.
We follow the principle of least privilege. Only core engineers with a direct need have access to production infrastructure. All access is logged and audited regularly. Multi-factor authentication is required for all team members with infrastructure access.
Layerdock is hosted on Vercel (edge + serverless functions) and Supabase (PostgreSQL database + storage). Both providers maintain SOC 2 Type II certification and comply with industry-standard security practices including regular penetration testing and 24/7 monitoring.
We use Supabase Auth with Google as the sign-in provider. Passwords are never stored on our infrastructure because there are none to store — authentication is delegated to Google, so your account is protected by whatever multi-factor policy you already enforce there. Session tokens are short-lived, verified on every request, and rotated regularly.
Paddle handles all payment processing as merchant of record. Your card details never touch our servers. Billing data we store is limited to what subscription management requires (plan tier, status, billing period, and the provider-side subscription id).
We run automated dependency scanning and security audits as part of our CI/CD pipeline. We have a responsible disclosure program — if you find a security issue, please report it to security@layerdock.io. We aim to acknowledge reports within 24 hours.